Index Multiple Domains- Can this app index data from multiple domains?

[jasondell]

Can this app index data from multiple domains? We are in an environment that has multiple trusted AD domains and we want to use this app to index all of the domains.

[jnguy_qmulos]

there is no way around this by having one UF on a DC collecting the whole domain/forest data from the GC?

[shogan_splunk · Accepted solution]

Yes, as long as you have 1 Windows Splunk Forwarder system per Domain collecting admon data, with an initial baseline admonEventType="Sync" collected for each.